acme.sh is a pure shell (POSIX sh) ACME protocol client for automated TLS/SSL certificate lifecycle management. It supports multiple Certificate Authorities (Let's Encrypt, ZeroSSL, Google, SSL.com, Actalis) and provides a wide range of validation methods including HTTP-01 (webroot, standalone, Apache, Nginx), DNS-01 (via 150+ DNS provider APIs), and TLS-ALPN-01. The tool is designed for unattended cron-based renewal and includes deploy hooks for installing certificates into various services (web servers, routers, firewalls, etc.) and notification hooks for alerting on renewal outcomes. The architecture is a monolithic shell script (acme.sh) that sources plugin modules from dnsapi/, deploy/, and notify/ directories. Each plugin follows a consistent function naming convention (e.g., dns_<provider>_add/rm, <target>_deploy, <service>_send) and uses shared internal helpers for HTTP requests, credential persistence, and JSON/XML parsing. The project emphasizes cross-platform compatibility (Linux, macOS, BSDs, Solaris, Windows/Cygwin) and avoids external dependencies beyond curl/wget and openssl. Key features include ECDSA and RSA key support, wildcard certificates, OCSP Must-Staple, External Account Binding (EAB), ACME Renewal Information (ARI, RFC 9773), and automatic upgrade. The codebase is well-tested across 20+ operating systems via GitHub Actions CI, using both Pebble test servers and real CAs. While the monolithic core script is large (~4000 lines), the plugin architecture enables easy extension for new DNS providers, deployment targets, and notification channels.
SiteEncrypt is an Elixir library that provides automated SSL/TLS certificate management for web applications through integration with Let's Encrypt. It handles the complete certificate lifecycle including automatic obtainment, renewal, and configuration of web servers to use the certificates. The library supports both the official Certbot client and a native Elixir ACME protocol implementation, with automatic renewal scheduling designed to prevent thundering herd problems on certificate authorities. It integrates specifically with the Phoenix web framework but can work with other Erlang-based web servers through its adapter pattern.